@antprofuse/saddle-skill 0.2.0 → 0.3.0-alpha.2

package/scripts/validate-identity-closure.py

@@ -1,138 +0,0 @@
-#!/usr/bin/env python3
-"""Fail closed unless every packaged Skill identity comes from one closure."""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import re
-import sys
-from pathlib import Path
-
-
-def digest(path: Path) -> str:
-    return hashlib.sha256(path.read_bytes()).hexdigest()
-
-
-def exactly(pattern: str, text: str, label: str) -> str:
-    values = re.findall(pattern, text, flags=re.MULTILINE)
-    if len(values) != 1:
-        raise SystemExit(f"identity closure invalid: {label} count={len(values)}")
-    return values[0]
-
-
-def main() -> None:
-    if len(sys.argv) != 2:
-        raise SystemExit("usage: validate-identity-closure.py <skill-directory>")
-    skill = Path(sys.argv[1]).resolve()
-    manifest = json.loads((skill / "package-manifest.json").read_text(encoding="utf-8"))
-    closure_path = skill / manifest["identity_closure"]["path"]
-    closure = json.loads(closure_path.read_text(encoding="utf-8"))
-    if closure.get("schema") != "saddle-skill-identity-closure/2":
-        raise SystemExit("identity closure invalid: schema")
-    if digest(closure_path) != manifest["identity_closure"]["sha256"]:
-        raise SystemExit("identity closure invalid: closure digest")
-
-    source = closure["artifact_source_commit"]
-    snapshot = skill / "references/public-api.snapshot"
-    boundary = skill / "references/api-boundary.md"
-    machine_doc = skill / "references/machine-schema.md"
-    validator = skill / "scripts/validate-machine-input.sh"
-    observed = {
-        "manifest": manifest["rust"]["source_commit"],
-        "snapshot": exactly(r"^source_commit=([0-9a-f]{40})$", snapshot.read_text(), "snapshot source"),
-        "boundary": exactly(r"Facade source `([0-9a-f]{40})`", boundary.read_text(), "boundary source"),
-        "validator": exactly(r"rust_facade_source=([0-9a-f]{40})", validator.read_text(), "validator source"),
-    }
-    if set(observed.values()) != {source}:
-        raise SystemExit(f"identity closure invalid: source drift {observed}")
-    registry_source = closure.get("registry_artifact_source_commit")
-    if not re.fullmatch(r"[0-9a-f]{40}", registry_source or "") or registry_source != source:
-        raise SystemExit("identity closure invalid: registry/source identity mismatch")
-    if manifest.get("release_approval") is not False or manifest.get("publish") is not False:
-        raise SystemExit("identity closure invalid: incompatible registry candidate must remain unpublished")
-    documented_schema = exactly(
-        r"machine：`(saddle-approved-build/[0-9]+)`", machine_doc.read_text(), "machine schema"
-    )
-    if {documented_schema, manifest["skill"]["machine_schema"], closure["machine_schema"]} != {"saddle-approved-build/2"}:
-        raise SystemExit("identity closure invalid: machine schema drift")
-    if digest(snapshot) != closure["public_api_snapshot_sha256"]:
-        raise SystemExit("identity closure invalid: snapshot digest")
-    if digest(machine_doc) != closure["machine_schema_document_sha256"]:
-        raise SystemExit("identity closure invalid: machine schema digest")
-    if manifest["rust"]["public_api_snapshot_sha256"] != closure["public_api_snapshot_sha256"]:
-        raise SystemExit("identity closure invalid: manifest snapshot digest")
-    expected_locks = {"registry_consumer": digest(skill / "assets/registry-consumer/Cargo.lock")}
-    if manifest["consumer_evidence"]["approved_locks"] != expected_locks or closure["approved_locks"] != expected_locks:
-        raise SystemExit("identity closure invalid: approved locks")
-    template_root = skill / "assets/registry-consumer"
-    template_inputs = {
-        "cargo_lock": template_root / "Cargo.lock",
-        "cargo_manifest": template_root / "Cargo.toml",
-        "library": template_root / "src/lib.rs",
-        "generated_owner": template_root / "src/generated_artifact.rs",
-        "external_consumer_test": template_root / "tests/provider_consumer.rs",
-        "output_validator": skill / "scripts/validate-generated-project.sh",
-        "preflight_validator": skill / "scripts/validate-generated-preflight.sh",
-        "cache_key_builder": skill / "scripts/validation-cache-key.py",
-    }
-    observed_template = {name: digest(path) for name, path in template_inputs.items()}
-    template_identity = hashlib.sha256(
-        json.dumps(observed_template, separators=(",", ":")).encode()
-    ).hexdigest()
-    if closure.get("registry_consumer_template") != observed_template:
-        raise SystemExit("identity closure invalid: registry consumer template")
-    if manifest["consumer_evidence"].get("registry_consumer_template") != observed_template:
-        raise SystemExit("identity closure invalid: manifest registry consumer template")
-    if closure.get("template_identity_sha256") != template_identity or manifest["generated_static_facts"].get("template_identity_sha256") != template_identity:
-        raise SystemExit("identity closure invalid: template identity")
-    if manifest["generated_static_facts"].get("application_machine_fingerprint") != "NOT_GENERATED_SK_02":
-        raise SystemExit("identity closure invalid: SK-02 fabricated application fingerprint")
-    if manifest["consumer_evidence"].get("unified_application_sha256") != observed_template["library"] or closure.get("unified_application_sha256") != observed_template["library"]:
-        raise SystemExit("identity closure invalid: unified application")
-    if manifest["consumer_evidence"].get("unified_owner_sha256") != observed_template["generated_owner"] or closure.get("unified_owner_sha256") != observed_template["generated_owner"]:
-        raise SystemExit("identity closure invalid: unified owner")
-    if manifest.get("gate_identity") != closure.get("gate_identity"):
-        raise SystemExit("identity closure invalid: Gate identity")
-    gate = closure.get("gate_identity", {})
-    if not re.fullmatch(r"[0-9a-f]{40}", gate.get("d1_source_candidate", "")):
-        raise SystemExit("identity closure invalid: D1 source candidate")
-    for name, value in gate.items():
-        if name != "d1_source_candidate" and not re.fullmatch(r"[0-9a-f]{64}", value):
-            raise SystemExit(f"identity closure invalid: Gate digest {name}")
-    for field in (
-        "registry_artifact_source_commit",
-        "rust_candidate_manifest_sha256",
-        "registry_packages_sha256",
-        "framework_crate_sha256",
-        "fresh_registry_cargo_lock_sha256",
-        "registry_consumer_cargo_lock_sha256",
-    ):
-        if manifest["identity_closure"][field] != closure[field]:
-            raise SystemExit(f"identity closure invalid: {field}")
-    expected_packages = {
-        "saddle-core", "saddle-macros", "saddle-admission", "saddle-observability", "saddle-runtime",
-        "saddle-db", "saddle-service", "saddle-framework",
-    }
-    if set(closure.get("registry_packages_sha256", {})) != expected_packages:
-        raise SystemExit("identity closure invalid: registry package set")
-    if any(not re.fullmatch(r"[0-9a-f]{64}", value) for value in closure["registry_packages_sha256"].values()):
-        raise SystemExit("identity closure invalid: registry package digest")
-    if manifest["npm"]["version"] != "0.2.0" or closure.get("skill_release") != "0.2.0":
-        raise SystemExit("identity closure invalid: Skill candidate version")
-    if manifest["rust"]["requirement"] != "=0.2.0" or closure.get("rust_release") != "0.2.0":
-        raise SystemExit("identity closure invalid: Rust RC version")
-    installation = manifest.get("installation", {})
-    if installation != {
-        "kind": "npm-tgz",
-        "command": "npm install --ignore-scripts --no-audit --no-fund <exact-tgz>",
-        "skill_root": "node_modules/@antprofuse/saddle-skill",
-        "entry": "SKILL.md",
-        "lifecycle_scripts": False,
-    }:
-        raise SystemExit("identity closure invalid: installation entry")
-    print("saddle-skill-identity-closure/2: valid")
-
-
-if __name__ == "__main__":
-    main()

package/scripts/validate-machine-input.sh

@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [[ $# -ne 1 || ! -f "$1" ]]; then
-  echo "usage: validate-machine-input.sh <machine-input>" >&2
-  exit 64
-fi
-input=$1
-expected_keys=(
-  schema status release_approval declaration_schema skill_package rust_facade
-  rust_facade_source rust_compatibility rust_abi_frozen public_api public_api_snapshot
-  generated_static_schema generator_handoff build_internal runtime_profile
-  signed_production_bundle final_calibration baseline declaration_sha256
-  public_api_snapshot_sha256 skill_sha256 package_manifest_sha256 machine_schema_sha256
-  api_consumer_lock_sha256 unified_consumer_lock_sha256
-  query_db_compile_fail_lock_sha256 raw_signal_compile_fail_lock_sha256
-  generated_application_sha256 unified_owner_sha256 unified_machine_fingerprint
-  rustc_commit contract_validation unified_consumer_validation
-  public_api_snapshot_validation generated_static_validation migration_compile_fail
-  npm_pack_dry_run
-)
-actual_keys_file="$(mktemp)"
-expected_keys_file="$(mktemp)"
-trap 'rm -f "$actual_keys_file" "$expected_keys_file"' EXIT
-awk -F= 'NF < 2 || $1 !~ /^[a-z][a-z0-9_]*$/ { exit 2 } { print $1 }' "$input" |
-  LC_ALL=C sort >"$actual_keys_file" || {
-    echo "invalid machine key/value syntax" >&2
-    exit 1
-  }
-printf '%s\n' "${expected_keys[@]}" | LC_ALL=C sort >"$expected_keys_file"
-if [[ "$(uniq -d "$actual_keys_file" | wc -l)" -ne 0 ]] ||
-  ! diff -u "$expected_keys_file" "$actual_keys_file"; then
-  echo "unknown, duplicate, or missing machine field" >&2
-  exit 1
-fi
-grep -Fxq 'schema=saddle-approved-build/2' "$input"
-grep -Fxq 'status=rc-blackbox-candidate-unpublished' "$input"
-grep -Fxq 'release_approval=false' "$input"
-grep -Fxq 'rust_facade_source=96cd4ec8da55b0770c5d3e8275c74e65241a4759' "$input"
-grep -Fxq 'generated_static_schema=saddle-generated-static-facts/2' "$input"
-grep -Fxq 'runtime_profile=opaque-verified-startup-plan-layout' "$input"
-grep -Fxq 'signed_production_bundle=deployment-required' "$input"
-grep -Fxq 'final_calibration=deployment-required' "$input"
-if grep -Eq '(^|_)(capacity_profile|capacity_domain|task_storage|deadline_ms)=' "$input"; then
-  echo "generated machine input contains a deployment-owned field" >&2
-  exit 1
-fi
-echo "saddle-approved-build/2 machine input: rc-blackbox-candidate-unpublished"

package/scripts/validate-managed-objects-peak.py

@@ -1,147 +0,0 @@
-#!/usr/bin/env python3
-"""Validate canonical Saddle generated managed-object peak machine facts."""
-
-from __future__ import annotations
-
-import re
-import sys
-from pathlib import Path
-
-U64_MAX = (1 << 64) - 1
-BASE_KEYS = {
-    "schema",
-    "target_pointer_width",
-    "runtime_profile_sha256",
-    "max_active_requests",
-    "max_waiters",
-    "waiter_managed_objects_peak",
-    "route_count",
-    "max_route_managed_objects_peak",
-    "managed_objects_peak",
-    "derivation",
-}
-ROUTE_FIELDS = {
-    "path",
-    "artifact_sha256",
-    "request_body_owners",
-    "response_reservation_owners",
-    "other_managed_owners",
-    "managed_objects_peak",
-}
-ROUTE_KEY = re.compile(r"route\.(\d+)\.([a-z][a-z0-9_]*)\Z")
-
-
-def fail(message: str) -> None:
-    raise ValueError(message)
-
-
-def checked(value: int, label: str) -> int:
-    if value < 0 or value > U64_MAX:
-        fail(f"{label} exceeds target usize")
-    return value
-
-
-def number(values: dict[str, str], key: str) -> int:
-    text = values[key]
-    if not re.fullmatch(r"0|[1-9][0-9]*", text):
-        fail(f"{key} is not canonical unsigned decimal")
-    return checked(int(text), key)
-
-
-def validate(path: Path) -> None:
-    values: dict[str, str] = {}
-    routes: dict[int, dict[str, str]] = {}
-    for line_number, raw in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
-        if not raw or "=" not in raw:
-            fail(f"line {line_number} is not canonical key=value")
-        key, value = raw.split("=", 1)
-        if key in values:
-            fail(f"duplicate field: {key}")
-        match = ROUTE_KEY.fullmatch(key)
-        if match:
-            index = int(match.group(1))
-            field = match.group(2)
-            if field not in ROUTE_FIELDS:
-                fail(f"unknown route field: {key}")
-            route = routes.setdefault(index, {})
-            if field in route:
-                fail(f"duplicate route field: {key}")
-            route[field] = value
-        elif key not in BASE_KEYS:
-            fail(f"unknown field: {key}")
-        values[key] = value
-
-    missing_base = BASE_KEYS - values.keys()
-    if missing_base:
-        fail(f"missing fields: {','.join(sorted(missing_base))}")
-    if values["schema"] != "saddle-managed-objects-peak/1":
-        fail("unsupported managed-object peak schema")
-    if values["target_pointer_width"] != "64":
-        fail("only the approved 64-bit target is supported")
-    if values["derivation"] != "checked(active*max_route+waiters*waiter)":
-        fail("unexpected derivation")
-
-    route_count = number(values, "route_count")
-    if route_count == 0 or set(routes) != set(range(route_count)):
-        fail("route set is missing, sparse, or contains an unexpected route")
-
-    route_peaks: list[int] = []
-    paths: set[str] = set()
-    for index in range(route_count):
-        route = routes[index]
-        missing = ROUTE_FIELDS - route.keys()
-        if missing:
-            fail(f"route.{index} missing fields: {','.join(sorted(missing))}")
-        if not route["path"].startswith("/") or route["path"] in paths:
-            fail(f"route.{index}.path is invalid or duplicated")
-        paths.add(route["path"])
-        if not re.fullmatch(r"[0-9a-f]{64}", route["artifact_sha256"]):
-            fail(f"route.{index}.artifact_sha256 is not SHA-256")
-
-        components = []
-        for field in (
-            "request_body_owners",
-            "response_reservation_owners",
-            "other_managed_owners",
-        ):
-            components.append(
-                number(values, f"route.{index}.{field}")
-            )
-        if components != [1, 1, 0]:
-            fail(f"route.{index} is not the generated linear owner shape")
-        peak = number(values, f"route.{index}.managed_objects_peak")
-        if checked(sum(components), f"route.{index} component sum") != peak:
-            fail(f"route.{index} peak drifted from its owner components")
-        route_peaks.append(peak)
-
-    maximum = max(route_peaks)
-    if number(values, "max_route_managed_objects_peak") != maximum:
-        fail("max route peak drifted")
-
-    active = number(values, "max_active_requests")
-    waiters = number(values, "max_waiters")
-    waiter_peak = number(values, "waiter_managed_objects_peak")
-    if waiter_peak != 0:
-        fail("pre-admission waiters cannot own generated route objects")
-    active_total = checked(active * maximum, "active managed-object product")
-    waiter_total = checked(waiters * waiter_peak, "waiter managed-object product")
-    total = checked(active_total + waiter_total, "managed-object total")
-    if number(values, "managed_objects_peak") != total:
-        fail("managed_objects_peak drifted from checked derivation")
-
-
-def main() -> int:
-    if len(sys.argv) != 2:
-        print("usage: validate-managed-objects-peak.py <machine-facts>", file=sys.stderr)
-        return 64
-    try:
-        validate(Path(sys.argv[1]))
-    except (OSError, ValueError) as error:
-        print(f"managed-object peak invalid: {error}", file=sys.stderr)
-        return 1
-    print("saddle-managed-objects-peak/1: valid")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

package/scripts/validation-cache-key.py

@@ -1,88 +0,0 @@
-#!/usr/bin/env python3
-"""Build the deterministic P2 validation identity for an entry-local run."""
-
-from __future__ import annotations
-
-import argparse
-import hashlib
-import json
-from pathlib import Path
-
-
-def hash_parts(parts: list[tuple[str, bytes]]) -> str:
-    digest = hashlib.sha256()
-    for name, payload in parts:
-        encoded = name.encode("utf-8")
-        digest.update(len(encoded).to_bytes(8, "big"))
-        digest.update(encoded)
-        digest.update(len(payload).to_bytes(8, "big"))
-        digest.update(payload)
-    return digest.hexdigest()
-
-
-def source_digest(project: Path) -> str:
-    paths = [project / "Cargo.toml"]
-    for directory in (project / "src", project / "tests"):
-        if directory.is_dir():
-            paths.extend(path for path in directory.rglob("*.rs") if path.is_file())
-    unique = sorted(set(paths), key=lambda item: item.relative_to(project).as_posix())
-    return hash_parts(
-        [(path.relative_to(project).as_posix(), path.read_bytes()) for path in unique]
-    )
-
-
-def parse_contract(value: str) -> tuple[str, Path]:
-    if "=" not in value:
-        raise argparse.ArgumentTypeError("build contract must be label=path")
-    label, raw_path = value.split("=", 1)
-    if not label or not raw_path:
-        raise argparse.ArgumentTypeError("build contract must be label=path")
-    path = Path(raw_path).resolve()
-    if not path.is_file():
-        raise argparse.ArgumentTypeError(f"build contract is not a file: {path}")
-    return label, path
-
-
-def main() -> None:
-    parser = argparse.ArgumentParser()
-    subparsers = parser.add_subparsers(dest="command", required=True)
-    key_parser = subparsers.add_parser("cache-key")
-    key_parser.add_argument("--project", type=Path, required=True)
-    key_parser.add_argument("--rustc-version", required=True)
-    key_parser.add_argument("--toolchain-identity", required=True)
-    key_parser.add_argument("--target-triple", required=True)
-    key_parser.add_argument("--feature-set", required=True)
-    key_parser.add_argument("--build-contract", action="append", type=parse_contract, required=True)
-    args = parser.parse_args()
-
-    project = args.project.resolve()
-    lock = project / "Cargo.lock"
-    if not lock.is_file():
-        raise SystemExit(f"Cargo.lock is missing: {lock}")
-    contracts = sorted(args.build_contract, key=lambda item: item[0])
-    build_contract_digest = hash_parts([(label, path.read_bytes()) for label, path in contracts])
-    inputs = {
-        "RUSTC_VERSION": args.rustc_version,
-        "TOOLCHAIN_IDENTITY": args.toolchain_identity,
-        "TARGET_TRIPLE": args.target_triple,
-        "FEATURE_SET": args.feature_set,
-        "LOCK_DIGEST": hashlib.sha256(lock.read_bytes()).hexdigest(),
-        "SOURCE_DIGEST": source_digest(project),
-        "BUILD_CONTRACT_DIGEST": build_contract_digest,
-    }
-    canonical = [inputs[name] for name in (
-        "RUSTC_VERSION", "TOOLCHAIN_IDENTITY", "TARGET_TRIPLE", "FEATURE_SET",
-        "LOCK_DIGEST", "SOURCE_DIGEST", "BUILD_CONTRACT_DIGEST",
-    )]
-    output = {
-        "schema": "saddle-skill-validation-cache-key/1",
-        "inputs": inputs,
-        "cache_key": hashlib.sha256(
-            json.dumps(canonical, separators=(",", ":")).encode("utf-8")
-        ).hexdigest(),
-    }
-    print(json.dumps(output, separators=(",", ":"), sort_keys=True))
-
-
-if __name__ == "__main__":
-    main()